diff options
Diffstat (limited to 'packages/meshbay-client/src/main.js')
| -rw-r--r-- | packages/meshbay-client/src/main.js | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js index ab579a1..83cf772 100644 --- a/packages/meshbay-client/src/main.js +++ b/packages/meshbay-client/src/main.js @@ -112,7 +112,25 @@ const CSP = [ "font-src 'self'", "connect-src 'self' https: wss:", "worker-src 'self'", - `frame-src ${RECAPTCHA_SRC}`, + // `blob:` here and in `frame-src` are one thing, not two: the PDF preview. + // + // `files-app.js` decrypts a PDF in the page, wraps it in a Blob and hands it + // to `<object type="application/pdf">`, so the bytes never leave the + // renderer. Chromium serves that with its own viewer, and the viewer takes + // TWO permissions — it loads the resource as plugin data (`object-src`, + // which was falling back to `default-src 'none'`) and then renders it in an + // internal frame (`frame-src`). Fixing either alone still shows the "this + // browser will not display the PDF inline" fallback, which is how this + // looked like a missing feature rather than a policy. + // + // `'self'` does not cover it: a same-origin `blob:` URL is NOT matched by + // `'self'` in either directive — measured on Chromium 152, this build's and + // Chrome's alike — so the token has to be `blob:` in both. Only page script + // can mint a blob URL and the type is set by our code, so what this admits + // is PDFium parsing bytes that came from a node — exactly what a browser + // does with the same file. + "object-src blob:", + `frame-src blob: ${RECAPTCHA_SRC}`, "frame-ancestors 'none'", "base-uri 'none'", "form-action 'none'", |